What They Know The Business of Tracking You on the Internet A Wall Street Journal Investigation 2 Table of Contents Introduction .............................................................................. 3 Contributors .............................................................................. 6 The Web's New Gold Mine: Your Secrets ....................................................... 7 Explore the Data ....................................................................................... 14 Sites Feed Personal Details To New Tracking Industry ......................... 15 How to Avoid the Prying Eyes ................................................................. 17 What They Know About You ................................................................... 20 Microsoft Quashed Effort To Boost Online Privacy .................................... 22 On the Web's Cutting Edge, Anonymity in Name Only ............................... 27 Stalking by Cellphone ................................................................................... 33 Google Agonizes on Privacy as Ad World Vaults Ahead ............................. 39 On the Web, Children Face Intensive Tracking .......................................... 45 Explore the Data ...................................................................................... 50 How to Protect Your Child’s Privacy Online ........................................... 51 'Scrapers' Dig Deep For Data on Web ..........................................................53 Facebook in Privacy Breach ......................................................................... 58 A Web Pioneer Profiles Users by Name ...................................................... 62 Politicians Tap Sophisticated Online Tracking Tools ............................ 68 Insurers Test Data Profiles To Identify Risky Clients ................................. 70 Inside Deloitte's Life-Insurance Assessment Technology ....................... 75 Shunned Profiling Method On the Verge of Comeback ............................... 76 Race Is On To ‘Fingerprint’ Phones, PCs ...................................................... 81 How To Prevent Device Fingerprinting ................................................. 86 Your Apps Are Watching You ...................................................................... 88 Explore the Data ...................................................................................... 94 What Can You Do? Not Much .................................................................. 95 What Settings to Look For in Apps ......................................................... 96 Methodology ............................................................................................. 98 Tracking the Trackers: Our Method ............................................................ 99 How the Analysis of Children's Websites Was Conducted ........................ 101 The Journal's Cellphone Testing Methodology .......................................... 103 Glossary ....................................................................................................... 104 THE WALL STREET JOURNAL is a trademark of Dow Jones. © 2010 by Dow Jones & Company, Inc. All rights reserved 3 Introduction What do they know about me? Who hasn't wondered that after receiving a spookily correct mortgage offer for the exact balance of your debt? Or when an ad appears on your computer screen for something you were just thinking about but hadn't typed yet? Our modern life is filled with these minor but eerie intrusions – whether they arrive in snail mail, the e-mail inbox, or pop up as we browse the Web. Marketers are indeed watching us and compiling dossiers about us all the time. But until recently, there wasn't an easy way to find out what they knew about us. Until the Internet came along, the information that companies had about us was stored in dusty files and used primarily by the folks filling our mailboxes with junk mail. Gathering information about people was expensive and difficult: data brokers had to gather people's real estate records, motor vehicle records and keep up with Americans’ propensity to move every few years. The Internet made monitoring people much easier. Suddenly companies could embed a tiny piece of code in a website and see anything that a person was doing on a web page. As people spent more time online, more of their life could be monitored. By 2010, online tracking had become a fundamental part of the $23 billion online advertising economy. Hundreds of companies popped up to offer new ways to track users online. Trading floors emerged to allow our digital records to be bought and sold in an instant. And the beauty of these digital files was that occasionally they could be decoded – revealing a dossier for the first time. Most people surfing the Web had no idea of the scope and intrusiveness of this new industry that was watching their every move. So The Wall Street Journal sought to decode these new tracking technologies, allowing readers for the first time to glimpse behind the curtain of the personal data-gathering industry. It wasn’t an easy task. The Journal reporters learned how to "sniff on the wire" – or decode computer talk – to identify tracking tools on the 100 of the most popular kids and adult websites. The Journal hired technologists to set up a THE WALL STREET JOURNAL is a trademark of Dow Jones. © 2010 by Dow Jones & Company, Inc. All rights reserved 4 mobile lab in Denver to test "apps" in a secure environment – disabling the phones' cellular service and forcing traffic through Wi-Fi where it could be collected and analyzed in a groundbreaking study. Journal reporters cracked computer code to reveal a significant Facebook privacy breach, and how Capital One was using tracking data to estimate the incomes and lifestyles of visitors to its website. The series launched on July 31, 2010, with an online database of all the tracking tools the Journal had found in its visits to the top 50 U.S. websites. Its findings included: 234 tracking devices on Dictionary.com alone; companies estimating income and diseases of users; and a company tracking people's favorite movies as they typed them into a website. The Journal's reporting shocked even the technology elite, many of whom hadn't realized how sophisticated the tracking industry had become. "It’s pretty freaking amazing — and amazingly freaky," Doc Searls, a fellow at Harvard University's Berkman Center for Internet and Society, wrote on his blog the day the series launched. "The tide has turned today." The tide continued to turn throughout the year, as the Journal revealed more disturbing facts about the commercial data-gathering industry. It caught red-handed a company breaking Facebook's rules to obtain user names for sale. It nabbed Nielsen Co. breaking into a medical website to "scrape" patient data and sell it. It revealed companies using undetectable tracking techniques, such as "deep packet inspection" and "device fingerprinting." It found that advertisers had influenced Microsoft's decision to remove privacy features from its Web browser. It found that children's websites were more heavily monitored than adults’. It found that iPhone and Android "apps" were secretly sending out data about users to tracking companies. And the Journal found that tracking data was being used by life insurers and credit card issuers to help make financial decisions about customers. In short, the Journal unveiled a massive surveillance industry using sophisticated tools to secretly monitor users’ behavior – and to use that information to make important decisions about people's lives. The impact of the series was profound. Driven by swelling public concern about tracking, the Obama administration reversed the government's decade- long hands-off approach to Internet privacy regulation and called for an Internet "privacy bill of rights." The Federal Trade Commission, which had previously supported the industry's self-regulatory efforts, declared in December that self- regulation had failed and called for a do-not-track tool to be installed in Web browsing software. Companies also began changing their privacy practices in response to the Journal's reporting. Facebook banned the data collection company RapLeaf Inc. THE WALL STREET JOURNAL is a trademark of Dow Jones. © 2010 by Dow Jones & Company, Inc. All rights reserved 5 from its website after the Journal revealed that RapLeaf was taking user information and transmitting it to tracking companies. After the Journal's article, Nielsen said it would no longer create fake usernames and passwords to log into private message boards to scrape data. In December, Microsoft Corp. reversed its decision to remove privacy tools from its Web browser. It will add a powerful privacy feature similar to the one it dropped from an earlier version back into Internet Explorer 9 when it launches in 2011. Mozilla Corp. soon followed by announcing it would add a do-not-track tool to the Firefox Web browser. And Google said it would improve an anti- tracking tool it offered. And the debate about tracking is only beginning. Online tracking tools are getting ever more sophisticated. Ultimately, we will need to decide how much surveillance we as a society are willing to accept. JULIA ANGWIN Senior technology editor, WSJ.com THE WALL STREET JOURNAL is a trademark of Dow Jones. © 2010 by Dow Jones & Company, Inc. All rights reserved 6 Contributors Reporters Julia Angwin, Geoffrey Fowler, Yukari Iwatani Kane,